A good breach notice says what happened, what information was involved, what you have done, what recipients can do to protect themselves and how to reach you. The FTC guide for businesses lists these elements, and GDPR Article 34 requires clear and plain language for high risk breaches. Legal duties vary by place, so check yours.
Elements from the FTC guide
The FTC's data breach response guide says notices should cover:
- How the breach happened, what information was taken and how it has been misused, if known.
- The steps you have taken to remedy the situation and protect affected people.
- Steps individuals can take, depending on the data exposed, with relevant contact information.
- How you will contact people in the future, which helps them spot phishing tied to the breach.
It also advises naming a single point person for releasing information, and reviewing notice content with law enforcement so it does not hamper an investigation.
What GDPR adds
Under Article 34, when a breach is likely to result in a high risk to people's rights and freedoms, the controller must tell the data subjects without undue delay, in clear and plain language. There are exceptions, including where the data was protected, such as by encryption that makes it unintelligible, or where later measures mean the high risk is no longer likely. If individual notice would take disproportionate effort, a public communication can be used instead. Article 34 also refers to details from Article 33(3), which this guide did not retrieve, so read that text directly.
A structure that works
- What happened, in two or three sentences.
- What was involved, by data category and date range.
- What we have done, concretely.
- What you can do, listed as steps.
- Contact, a named channel and hours.
- How we will communicate, so recipients can tell real messages from phishing.
Tone and honesty
The FTC guide says to avoid misleading statements and not to withhold details that would help people protect themselves. It also says not to share information that could put people at further risk. Do not minimise, and do not speculate about who did it.
Tests before sending
- Could a non technical reader act on it?
- Does every statement match what the investigation has confirmed?
- Does it agree with the status page, FAQ and support script?
Sources
Quick check
Does a notice have to name the attacker?
Neither source says it must. Avoid attribution until it is confirmed.
Is credit monitoring required?
The FTC guide suggests offering at least a year of free credit monitoring or identity restoration when financial data or Social Security numbers were exposed. Whether a law requires it depends on your location.
Last reviewed: 19 October 2026.
